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ABSTRACT: 

PURPOSE:To prevent the generation of system down when an emergency opera tion device is 
failed by duplicating both of emergency operation starting factor detecting parts and emergency 
operation control parts and storing outputs from both of the detecting parts and control parts in 
memories together with their generation time. 

CONSTITUTION:The emergency operation starting factor detecting parts 4a, 4b in emergency 
operation devices 3a, 3b always and mutually exchange and monitor respective processor status 
to/from processors 1a, 1 b in self-systems. When the detecting part 4a e.g. detects an emergency 
operation starting factor, the detecting part 4a starts an emergency operation control part 5a, and 
while monitoring also the detecting part 4b in the opposite system, informs a necessary 
emergency operation instruction to the processor 1a through an emergency operation instructing 
part 6a. The status information of the detecting part 4a and the control information of the control 
part 5a are stored in a 2-port memory 9a together with generation time based upon an 
emergency operation generating time managing clock generated from a clock generating part 
1 0a. The processor 1 a reads out the stored contents through a bus 2a. 
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